Subject: Re: [vserver] oom_adj error and sshd
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 27 Jan 2009 19:29:09 +0100

On Thu, Jan 22, 2009 at 11:48:32AM -0500, John A. Sullivan III wrote:
> Hello, all.  I've noticed I'm getting errors about my Ubuntu guest
> trying to adjust oom in /proc.  I've also found some very helpful
> discussions on this posted on-line.

> I could simply comment out the section of the init script which
> attempts the adjustment but would it make more sense to allow the
> guest to adjust oom in proc? If we are running out of memory, I'd
> rather sshd be one of the last processes killed.


from Documentation/filesystems/proc.txt

2.12 /proc/<pid>/oom_adj - Adjust the oom-killer score
------------------------------------------------------

This file can be used to adjust the score used to select which 
processes should be killed in an out-of-memory situation. 
Giving it a high score will increase the likelihood of this 
process being killed by the oom-killer. 
Valid values are in the range -16 to +15, plus the special
value -17, which disables oom-killing altogether for this 
process.

---

now while this makes perfectly sense in a 'normal' or 'trusted'
environment, it becomes somewhat questionable in a potentially
hostile environment ... what will keep Joe Evil from marking
all his guest processes with -17? or if we forbid this special
value, -16? 

I can see that we allow this setting based on a flag or that
we do some weighting which makes it guest relative or so, but
I'm not very fond of just enabling that entry and allowing a
guest to mess with it :)

> I also gather the guest is really not controlling memory but I 
> assume writing this to proc would tell the host to not kill this 
> sshd process on the guest. Is that correct? Thanks - John

yes, and the correct handling in the script would be to check
if that entry is available and writeable, and if not, then it
should silently ignore the fact, instead of bailing out

HTC,
Herbert

> -- 
> John A. Sullivan III
> Open Source Development Corporation
> +1 207-985-7880
> jsullivan@opensourcedevel.com
> 
> http://www.spiritualoutreach.com
> Making Christianity intelligible to secular society